chore: resolve dependabot security alerts

[MarshallOfSound]

Safe-only sweep of open Dependabot / yarn npm audit advisories. All changes are lockfile-only transitive refreshes (yarn up -R) within existing semver ranges — no package.json changes, no resolutions.

Package	Strategy	Version change
brace-expansion	yarn up -R (in-range)	2.0.2 → 2.0.3
brace-expansion	yarn up -R (in-range)	5.0.2 → 5.0.5
picomatch	yarn up -R (in-range)	4.0.3 → 4.0.4
tar	yarn up -R (in-range)	7.5.10 → 7.5.13
yaml	yarn up -R (in-range)	2.8.0 → 2.8.3

Flagged (not changed)

• @xmldom/xmldom (0.8.10, via plist) — patched version 0.8.12 was published 2026-03-29 and does not yet clear the 7-day npmMinimalAgeGate in .yarnrc.yml; re-run yarn up -R @xmldom/xmldom once it ages in.

Verified

• yarn install --immutable passes
• yarn npm audit --all --recursive --no-deprecations: 1 advisory remaining (@xmldom/xmldom, flagged above)
• No new peer-dependency warnings